5b4e091f4ff55c2d426ca3ab68714562387fb615b820bb32dd696a150f3330cd

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 08:11

Target

$APPDATA/ScanGuard/updates/SAVAPI 11.0.1/aeml.dll
Size

340KB
MD5

0de0cb670e3046e388829fdab6910a9c
SHA1

2b9daea0200fd1c442c9a3a967bf51d68f7ab80d
SHA256

537b3ea2ce48dc0cc343c1c6ce79ae5ba527b2fcddea24cadef1fc1eca8c42cc
SHA512

7e7ab02d20c3a1b8f76ce8c951570be1e719e0533ffc14970c958240a6adbe1c8ab88c826ef21083db0c74c6f83a1c9262ec6b2371b72d357bf6d5a298ba6f33
SSDEEP

3072:qsjdmLYGV1RkWeY9aN4R8kGW+JVhyTWrZy6xLqOVqrsyyP0Y:qsxmfRk4UkdGW+CqRVqrLY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2384 wrote to memory of 2096	2384	rundll32.exe	rundll32.exe
PID 2384 wrote to memory of 2096	2384	rundll32.exe	rundll32.exe
PID 2384 wrote to memory of 2096	2384	rundll32.exe	rundll32.exe
PID 2384 wrote to memory of 2096	2384	rundll32.exe	rundll32.exe
PID 2384 wrote to memory of 2096	2384	rundll32.exe	rundll32.exe
PID 2384 wrote to memory of 2096	2384	rundll32.exe	rundll32.exe
PID 2384 wrote to memory of 2096	2384	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\ScanGuard\updates\SAVAPI 11.0.1\aeml.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\ScanGuard\updates\SAVAPI 11.0.1\aeml.dll",#1
  2⤵
  PID:2096